Return on security investments - Towards a methodological foundation of measurement systems

Association for Information Systems - 13th Americas Conference on Information Systems, AMCIS 2007: Reaching New Heights

Volumn 1, Issue , 2007, Pages 418-426

  Brocke, Jan Vom ^a   Strauch, Gereon ^b   Buddendick, Christian ^b  

^a UNIVERSITY OF LIECHTENSTEIN   (Liechtenstein)

^b UNIVERSITY OF MÜNSTER   (Germany)

Author keywords

Economics of it security; Information systems security; It governance; Return on security investments (ROSI); Risk management

Indexed keywords

CAPITAL BUDGETING; DECISION MAKERS; DECISION SUPPORTS; INDIVIDUAL RISKS; INFORMATION SYSTEMS SECURITY; IT SECURITY; IT-GOVERNANCE; KEY TOPICS; MEASUREMENT SYSTEM; ORGANIZATIONAL INFRASTRUCTURE; SECURITY INVESTMENTS; SENSIBILITY ANALYSIS;

BUDGET CONTROL; DECISION SUPPORT SYSTEMS; INFORMATION SYSTEMS; INVESTMENTS; RISK ANALYSIS; RISK MANAGEMENT;

ECONOMICS;

EID: 84870162391     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (22)

1. Berinato, P.: Finally, a real return on security spending, http://www.cio.com/archive/021502/security.html [11/24/2006]. Bundesamt für Sicherheit in der Informationstechnik (BSI). Kosten und nutzen der IS-Sicherheit, Studie des BSI zur Technikfolgen-Abschätzung, 2000.
2. Butler, S. "Security attribute evaluation method: a cost-benefit approach," Proceedings of the 24th International Conference on Software Engineering, W. Tracz (ed.), Orlando, FL, 2002, pp. 232-240.
3. Cavusoglu, H., Mishra, B. and Raghunathan, P. "A model for evaluating is security investments," Communications of the ACM (47:1), 2004, pp. 87-92.
4. Gordon, L. A. and Loeb, M. P. "The economics of information security investment," ACM Transactions on Information and System Security (5:4), 2002, pp. 438-457.
5. Gordon, L., Loeb, M. P. "The economics of information security investement," ACM Transactions on Information and System Security (5:4), 2002, pp. 438-457.
6. Gordon, L., Loeb, M. P. "Budgeting process for information security expenditures," Communications of the ACM (49:1), 2005, pp. 121-125.
7. Grob, H. L. Capital budgeting with financial plans, Vahlen, München, 1993, pp. 50-80.
8. Hertz, D. B. "Risk Analysis in Capital Investment." Harvard Business Review (42:1), 1964, pp. 95-106.
9. Kaplan, R. P. "CIM-Investitionen sind keine Glaubensfragen," Harvard Manager (9:3), 1986, pp. 78-85.
10. Landoll, D. J. The security risk assessment handbook: a complete guide for performing security risk assessments, Auerbach Publications, Boca Raton, 2006, p. 372.
11. Mayer, B. Rosi - Return on Security Investment. Eine notwendige Rechnung, http://www.it-daily.net [05/02/2006].
12. McCumber, J. Assessing and managing security risk in IT systems: a structured methodology, Auerbach Publications, Boca Raton, 2005, pp. 192-196.
13. Mercury, R. T. "Analysing security costs," Communications of the ACM (46:6), 2003, pp. 15-18.
14. National Institute of Standards. Guideline for automatic data processing risk analysis, 1979.
15. Neubauer, T., Klemen, M. and Biffl, S. "Business process-based valuation of IT-security," Proceedings of the seventh international workshop on Economics-driven software engineering research, K. Sullivan (ed.), St. Louis, MO, 2005, pp. 1-5.
16. Nowey, T., Federrath, H., Klein, C. and Plößl, K. "Ansätze zur Evaluierung von Sicherheitsinvestitionen. Sicherheit 2005", Beiträge der 2. Jahrestagung des GI-Fachbereichs Sicherheit, Lecture Notes in Informatics (P-62), 2005, pp. 15-26.
17. Peltier, T. R. Information security risk analysis, Auerbach Publications, Boca Raton, 2001, pp. 5, 254.
18. Rodewald, G. "Aligning information security investments with a firm's risk tolerance," Proceedings of the 2nd annual conference on Information security curriculum development, M. E. Whitman (ed.), Kennesaw, GA,2005, pp. 139-141.
19. Sonnenreich, W., Albanese, J. and Stout, B. "Return on security investment (ROSI). A practical quantitative model," Working paper, New York, 2005.
20. Soo Hoo, K. J., (2000): How much is enough? A risk management approach to computer security, Consortium for Research on Information Security and Policy (CRISP), Stanford.
21. vom Brocke, J., (2007): Service Portfolio Measurement (SPM), A Decision Support System for the Management of Service- Oriented Information Systems, Enterprise Service Computing from Concept to Deployment. R. Qiu (Editor), Hershey, PA, USA 2007, pp. 58-90.
22. Wang, A. J. A. (2005), Information security models and metrics, Proceedings of the 43rd annual southeast regional conference - Volume 2, pp. 178-184.